Skip to content
NebulaCtrlInstall

Internals

View as Markdown

0005. License: AGPL-3.0-only

  • Status: accepted
  • Date: 2026-10-27
  • Decided by: the project owner, 2026-10-27 (supersedes the proposal of 2026-10-25)
  • Takes effect: when the source is published. The repository is private for now (owner decision, 2026-10-28). Until then NebulaCtrl is distributed free of charge as the installer, the public container images and the CLI served by the control plane, and is described as "free, self-hosted, source coming soon", not as open source. The licence decision, the LICENSE file and the rules below stay as written and apply from the day the source goes public. Publishing also means flipping the website and README wording and setting GITHUB_URL; the checklist is in CONTRIBUTING.md, "Release".

Context#

Spec §19.1 asks for a license choice before public release. Until this decision the repository had no LICENSE file, so the code was "all rights reserved" by default.

Relevant facts:

  • NebulaCtrl is self-hosted software: users run the control plane and the agents themselves. The owner expects third parties may also offer it as a hosted service.
  • nebulactrl/nebula (design-system source) is Apache-2.0; the ported web files keep compatible terms under the AGPL (Apache-2.0 is one-way compatible with GPLv3 and AGPLv3).
  • The dependency tree was scanned on 2026-10-27: see Third-party licences.

Options#

Apache-2.0 AGPL-3.0
Use, modify, self-host Unrestricted Unrestricted
Closed-source forks / commercial hosting by others Allowed Hosting a modified version as a network service requires publishing the changes
Patent grant Explicit Included (GPLv3 terms)
Adoption friction in companies Low Many companies forbid AGPL
Contributor/CLA pressure Low Needs a CLA if you later want dual licensing
Protection against a competitor offering a hosted NebulaCtrl None Strong
Compatibility with embedding in other products Easy Hard

Decision#

NebulaCtrl is licensed under the GNU Affero General Public License, version 3 only, SPDX identifier AGPL-3.0-only.

  • The canonical, unmodified text from https://www.gnu.org/licenses/agpl-3.0.txt is in LICENSE at the repository root.
  • "Only", not "or later": the project does not hand future relicensing decisions to the Free Software Foundation. Grafana and Mattermost make the same choice.
  • apps/web/package.json carries "license": "AGPL-3.0-only" and stays "private": true because it is not published to npm. Every other manifest in the repository carries the same field.
  • Dependencies must be compatible with the AGPL (permissive licences, LGPL, MPL-2.0 and similar). Proprietary, SSPL, BUSL, non-commercial and GPL-2.0-only dependencies are not allowed. The scan result and the rule are in Third-party licences.
  • Contributions are accepted under the same licence (inbound = outbound). There is no CLA today. Adding one, or any dual licensing, is a later owner decision and would need that consent.

Reasoning#

  • The owner's goal is to keep hosted derivatives open. The AGPL's network clause (§13) requires anyone who runs a modified NebulaCtrl as a network service to offer their users the corresponding source. Apache-2.0 gives no such protection.
  • Self-hosting, modification and internal use stay unrestricted, so the adoption cost falls on the few organisations that ban the AGPL, not on typical self-hosters. The comparable products the owner follows (Grafana, Mattermost) made the same trade.
  • The platform services NebulaCtrl deploys for users include AGPL software (Loki, Grafana). Using the AGPL for the platform itself is consistent with that and avoids a licence-mix story in the documentation.
  • The platform is not a library. Embedding in other products, the main AGPL drawback, is not a use case.

Consequences#

  • Public release and external contributions are no longer blocked by the licence question.
  • Container images that NebulaCtrl deploys (the template catalog, database engines, platform services such as Loki, Grafana, SeaweedFS, Headscale and Pocket ID) are separate works under their own licences. NebulaCtrl runs them unmodified in separate containers and does not link them; the AGPL of NebulaCtrl does not extend to them and theirs does not extend to NebulaCtrl.
  • Users who modify NebulaCtrl and offer it to others over a network must publish their modified source.
  • New dependencies must pass the licence rule above before they are approved.

Alternatives considered#

Apache-2.0 (the earlier recommendation for maximum adoption; rejected because it does not keep hosted derivatives open), MIT/BSD (no patent grant), MPL-2.0 (file-level copyleft; weaker fit for a single-binary product), AGPL-3.0-or-later (cedes future relicensing to the FSF), a source-available license such as BSL (contradicts spec §1.11 "open-source-ready").